@pikku/core 0.12.83 → 0.12.86

package/dist/ecosystem/scenario.d.ts

@@ -0,0 +1,21 @@
+export type { PikkuScenarioWire, ScenarioStepMeta, } from '../wirings/workflow/dsl/workflow-dsl.types.js';
+export { FileScenarioRunStore } from '../services/file-scenario-run-store.js';
+export type { FileScenarioRunStoreOptions } from '../services/file-scenario-run-store.js';
+export { addFeature, resolveFeatureScenarios, } from '../wirings/workflow/feature.js';
+export { PikkuScenarioService, createScenarioRunner, } from '../wirings/workflow/pikku-scenario-service.js';
+export { createCookieJar } from '../wirings/workflow/scenario-cookie-jar.js';
+export { pollUntil } from '../wirings/workflow/scenario-poll.js';
+export { composeStepProse } from '../wirings/workflow/scenario-prose.js';
+export { requireActor, requireScenarioEnv, } from '../wirings/workflow/scenario-step-guards.js';
+export { SCENARIO_SURFACES } from '../wirings/workflow/scenario-step.types.js';
+export type { PikkuBrowserWire, ScenarioBrowserFailure, ScenarioBrowserProvider, ScenarioStepKind, ScenarioStepOptions, ScenarioStepPhase, TestIdSelector, } from '../wirings/workflow/scenario-step.types.js';
+export type { CoreFeature, FeaturesMeta, } from '../wirings/workflow/scenario.types.js';
+export type { ScenarioArtifact, ScenarioArtifactKind, ScenarioFailureDetail, ScenarioResult, ScenarioRunRecord, ScenarioRunReport, ScenarioRunStatus, ScenarioRunStore, ScenarioRunSummary, ScenarioSkip, ScenarioStepRow, } from '../wirings/workflow/scenario-run.types.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { ScenarioSurface } from '../wirings/workflow/scenario-step.types.js';
+export type { FeaturePlanEntry } from '../wirings/workflow/scenario.types.js';
+export type { CoreWorkflow } from '../wirings/workflow/workflow.types.js';

package/dist/ecosystem/scenario.js

@@ -0,0 +1,8 @@
+export { FileScenarioRunStore } from '../services/file-scenario-run-store.js';
+export { addFeature, resolveFeatureScenarios, } from '../wirings/workflow/feature.js';
+export { PikkuScenarioService, createScenarioRunner, } from '../wirings/workflow/pikku-scenario-service.js';
+export { createCookieJar } from '../wirings/workflow/scenario-cookie-jar.js';
+export { pollUntil } from '../wirings/workflow/scenario-poll.js';
+export { composeStepProse } from '../wirings/workflow/scenario-prose.js';
+export { requireActor, requireScenarioEnv, } from '../wirings/workflow/scenario-step-guards.js';
+export { SCENARIO_SURFACES } from '../wirings/workflow/scenario-step.types.js';

package/dist/ecosystem/scheduler.d.ts

@@ -0,0 +1,3 @@
+export { SchedulerService } from '../services/scheduler-service.js';
+export { getScheduledTasks, runScheduledTask, } from '../wirings/scheduler/scheduler-runner.js';
+export type { CoreScheduledTask, ScheduledTasksMeta, } from '../wirings/scheduler/scheduler.types.js';

package/dist/ecosystem/scheduler.js

@@ -0,0 +1,2 @@
+export { SchedulerService } from '../services/scheduler-service.js';
+export { getScheduledTasks, runScheduledTask, } from '../wirings/scheduler/scheduler-runner.js';

package/dist/ecosystem/schema.d.ts

@@ -0,0 +1,2 @@
+export { addSchema, compileAllSchemas, getSchema } from '../schema.js';
+export type { SchemaService } from '../services/schema-service.js';

package/dist/ecosystem/schema.js

@@ -0,0 +1 @@
+export { addSchema, compileAllSchemas, getSchema } from '../schema.js';

package/dist/ecosystem/scope.d.ts

@@ -0,0 +1,5 @@
+export { hasScopes, verifyScopes } from '../scopes.js';
+export type { ScopeService } from '../services/scope-service.js';
+export { defineScope } from '../wirings/scope/define-scope.js';
+export type { CoreScopeNode, CoreScopes, FlatScope, ScopeDefinitionMeta, ScopeDefinitions, ScopeDefinitionsMeta, ScopeNodeMeta, } from '../wirings/scope/scope.types.js';
+export { flattenScopeDefinitions, validateAndBuildScopeDefinitionsMeta, } from '../wirings/scope/validate-scope-definitions.js';

package/dist/ecosystem/scope.js

@@ -0,0 +1,3 @@
+export { hasScopes, verifyScopes } from '../scopes.js';
+export { defineScope } from '../wirings/scope/define-scope.js';
+export { flattenScopeDefinitions, validateAndBuildScopeDefinitionsMeta, } from '../wirings/scope/validate-scope-definitions.js';

package/dist/ecosystem/secret.d.ts

@@ -0,0 +1,11 @@
+export { assertSecretAllowedForHost } from '../services/secret-host-binding.js';
+export type { SecretService, SecretValues } from '../services/secret-service.js';
+export type { CoreSecret, OAuth2CredentialConfig, SecretDefinitionMeta, SecretDefinitions, } from '../wirings/secret/secret.types.js';
+export { validateAndBuildSecretDefinitionsMeta } from '../wirings/secret/validate-secret-definitions.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { SchemaRefLike } from '../types/core.types.js';
+export type { SecretDefinitionsMeta } from '../wirings/secret/secret.types.js';

package/dist/ecosystem/secret.js

@@ -0,0 +1,2 @@
+export { assertSecretAllowedForHost } from '../services/secret-host-binding.js';
+export { validateAndBuildSecretDefinitionsMeta } from '../wirings/secret/validate-secret-definitions.js';

package/dist/ecosystem/services/istanbul-coverage.d.ts

@@ -0,0 +1 @@
+export { IstanbulCoverageService } from '../../services/istanbul-coverage-service.js';

package/dist/ecosystem/services/istanbul-coverage.js

@@ -0,0 +1 @@
+export { IstanbulCoverageService } from '../../services/istanbul-coverage-service.js';

package/dist/ecosystem/services/local-content-request-handler.d.ts

@@ -0,0 +1,9 @@
+export { createLocalContentRequestHandler, verifySignedContentRequest, } from '../../services/local-content-request-handler.js';
+export type { LocalContentRequestHandler } from '../../services/local-content-request-handler.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { JWTService } from '../../services/jwt-service.js';
+export type { LocalContentRequestHandlerOptions, SignedContentVerification, } from '../../services/local-content-request-handler.js';

package/dist/ecosystem/services/local-content-request-handler.js

@@ -0,0 +1 @@
+export { createLocalContentRequestHandler, verifySignedContentRequest, } from '../../services/local-content-request-handler.js';

package/dist/ecosystem/services/local-content.d.ts

@@ -0,0 +1,2 @@
+export { LocalContent, signedContentPath, } from '../../services/local-content.js';
+export type { LocalContentConfig } from '../../services/local-content.js';

package/dist/ecosystem/services/local-content.js

@@ -0,0 +1 @@
+export { LocalContent, signedContentPath, } from '../../services/local-content.js';

package/dist/ecosystem/services/local-meta.d.ts

@@ -0,0 +1 @@
+export { LocalMetaService } from '../../services/meta-service.js';

package/dist/ecosystem/services/local-meta.js

@@ -0,0 +1 @@
+export { LocalMetaService } from '../../services/meta-service.js';

package/dist/ecosystem/services/v8-coverage.d.ts

@@ -0,0 +1 @@
+export { V8CoverageService } from '../../services/v8-coverage-service.js';

package/dist/ecosystem/services/v8-coverage.js

@@ -0,0 +1 @@
+export { V8CoverageService } from '../../services/v8-coverage-service.js';

package/dist/ecosystem/services.d.ts

@@ -0,0 +1,36 @@
+export { NoopAuditService } from '../services/audit-service.js';
+export type { AuditDurability, AuditEvent, AuditEventBatch, AuditLog, AuditService, } from '../services/audit-service.js';
+export type { BucketKeyArgs, ContentService, CopyFileArgs, GetUploadURLArgs, SignContentKeyArgs, SignURLArgs, UploadURLResult, WriteFileArgs, } from '../services/content-service.js';
+export type { DeploymentConfig, DeploymentService, DeploymentServiceConfig, } from '../services/deployment-service.js';
+export { InMemoryAgentRunStateService } from '../services/in-memory-agent-run-state-service.js';
+export type { JWTService } from '../services/jwt-service.js';
+export { LocalEmailService } from '../services/local-email-service.js';
+export { LocalSecretService } from '../services/local-secrets.js';
+export { LocalVariablesService } from '../services/local-variables.js';
+export { ConsoleLogger } from '../services/logger-console.js';
+export { LogLevel } from '../services/logger.js';
+export type { AgentMeta, AgentsMeta, EmailTemplateMeta, EmailsMeta, GroupMeta, MCPMeta, MetaService, MiddlewareDefinitionMeta, MiddlewareGroupsMeta, MiddlewareInstanceMeta, PermissionDefinitionMeta, PermissionsGroupsMeta, RPCMetaRecord, ServiceMeta, ServicesMetaRecord, } from '../services/meta-service.js';
+export type { ResolvedPersona, ScenarioPersonas, } from '../services/personas-service.js';
+export { pikkuWebhookWorkerFunc } from '../services/queue-webhook-service.js';
+export type { ScheduledTaskInfo, ScheduledTaskSummary, } from '../services/scheduler-service.js';
+export type { SessionStore } from '../services/session-store.js';
+export { getStubTracker, isTestRun, spy } from '../services/stub-tracker.js';
+export type { CredentialMetaInfo } from '../services/typed-credential-service.js';
+export type { CredentialMeta } from '../services/typed-secret-service.js';
+export { TypedVariablesService } from '../services/typed-variables-service.js';
+export type { VariableMeta } from '../services/typed-variables-service.js';
+export { PikkuSessionService, createMiddlewareSessionWireProps, } from '../services/user-session-service.js';
+export type { CoverageFunctionMeta, CoverageService, FunctionCoverageEntry, FunctionCoverageReport, ScriptCoverage, } from '../services/v8-coverage-service.js';
+export { PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME } from '../services/webhook-service.js';
+export type { SendWebhookInput, SendWebhookResult, WebhookAttemptResult, WebhookDeliveryRecord, WebhookDeliveryWithAttempts, } from '../services/webhook-service.js';
+export type { FunctionMeta, FunctionsMeta, MiddlewareMetadata as MiddlewareMeta, PermissionMetadata as PermissionMeta, } from '../types/core.types.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { Logger } from '../services/logger.js';
+export type { StubTracker } from '../services/stub-tracker.js';
+export type { SessionService } from '../services/user-session-service.js';
+export type { WebhookJobData, WebhookService, } from '../services/webhook-service.js';
+export type { CoreUserSession } from '../types/core.types.js';

package/dist/ecosystem/services.js

@@ -0,0 +1,12 @@
+export { NoopAuditService } from '../services/audit-service.js';
+export { InMemoryAgentRunStateService } from '../services/in-memory-agent-run-state-service.js';
+export { LocalEmailService } from '../services/local-email-service.js';
+export { LocalSecretService } from '../services/local-secrets.js';
+export { LocalVariablesService } from '../services/local-variables.js';
+export { ConsoleLogger } from '../services/logger-console.js';
+export { LogLevel } from '../services/logger.js';
+export { pikkuWebhookWorkerFunc } from '../services/queue-webhook-service.js';
+export { getStubTracker, isTestRun, spy } from '../services/stub-tracker.js';
+export { TypedVariablesService } from '../services/typed-variables-service.js';
+export { PikkuSessionService, createMiddlewareSessionWireProps, } from '../services/user-session-service.js';
+export { PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME } from '../services/webhook-service.js';

package/dist/ecosystem/testing.d.ts

@@ -0,0 +1,7 @@
+export { defineServiceTests } from '../testing/service-tests.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { ServiceTestConfig } from '../testing/service-tests.js';

package/dist/ecosystem/testing.js

@@ -0,0 +1 @@
+export { defineServiceTests } from '../testing/service-tests.js';

package/dist/ecosystem/trigger.d.ts

@@ -0,0 +1,2 @@
+export { InMemoryTriggerService } from '../services/in-memory-trigger-service.js';
+export type { CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger, TriggerMeta, TriggerSourceMeta, } from '../wirings/trigger/trigger.types.js';

package/dist/ecosystem/trigger.js

@@ -0,0 +1 @@
+export { InMemoryTriggerService } from '../services/in-memory-trigger-service.js';

package/dist/ecosystem/types.d.ts

@@ -0,0 +1,12 @@
+export type { ClassificationManifest } from '../data-classification.js';
+export { isExpectedError } from '../errors/error-handler.js';
+export type { CorePermissionGroup } from '../function/functions.types.js';
+export { PikkuRequest } from '../pikku-request.js';
+export { SecretValue, createSecretValue, isSecretValue, } from '../secret-value.js';
+export type { Safe } from '../secret-value.js';
+export type { AuditFacets, AuditQuery, AuditQueryResult, } from '../services/audit-service.js';
+export { getRelativeTimeOffsetFromNow, parseDurationString, } from '../time-utils.js';
+export type { RelativeTimeInput } from '../time-utils.js';
+export type { AuthInstance, CoreConfig, CorePikkuMiddleware, CoreServices, CoreSingletonServices, CoreUserSession, CreateConfig, FunctionServicesMeta, FunctionWiresMeta, JSONValue, MiddlewareMetadata, PermissionMetadata, PikkuWire, PikkuWiringTypes, PostgresConfig, SecretlessServices, SecurityAuditIssue, SecurityAuditReport, SecurityAuditUpdate, SecuritySeverity, SecurityUpdateLevel, SerializedError, } from '../types/core.types.js';
+export { isSerializable, stopSingletonServices } from '../utils.js';
+export { formatVersionedId, isVersionedId, parseVersionedId, } from '../version.js';

package/dist/ecosystem/types.js

@@ -0,0 +1,6 @@
+export { isExpectedError } from '../errors/error-handler.js';
+export { PikkuRequest } from '../pikku-request.js';
+export { SecretValue, createSecretValue, isSecretValue, } from '../secret-value.js';
+export { getRelativeTimeOffsetFromNow, parseDurationString, } from '../time-utils.js';
+export { isSerializable, stopSingletonServices } from '../utils.js';
+export { formatVersionedId, isVersionedId, parseVersionedId, } from '../version.js';

package/dist/ecosystem/variable.d.ts

@@ -0,0 +1,9 @@
+export type { VariablesService } from '../services/variables-service.js';
+export { validateAndBuildVariableDefinitionsMeta } from '../wirings/variable/validate-variable-definitions.js';
+export type { CoreVariable, VariableDefinitionMeta, VariableDefinitions, VariableDefinitionsMeta, } from '../wirings/variable/variable.types.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { SchemaRefLike } from '../types/core.types.js';

package/dist/ecosystem/variable.js

@@ -0,0 +1 @@
+export { validateAndBuildVariableDefinitionsMeta } from '../wirings/variable/validate-variable-definitions.js';

package/dist/ecosystem/virtual-user.d.ts

@@ -0,0 +1,24 @@
+export { personaScopes, prepareVirtualUserRun, } from '../wirings/virtual-user/prepare-virtual-user-run.js';
+export { runVirtualUser } from '../wirings/virtual-user/run-virtual-user.js';
+export { catalogueClassification, isReadOnly, reachableCatalogue, unreachableCatalogue, } from '../wirings/virtual-user/virtual-user-catalogue.js';
+export { deriveCatalogue, deriveIntents, } from '../wirings/virtual-user/virtual-user-derive.js';
+export { DISPOSITIONS, dispositionProfile, } from '../wirings/virtual-user/virtual-user-dispositions.js';
+export type { DispositionProfile } from '../wirings/virtual-user/virtual-user-dispositions.js';
+export { intentsForPersona } from '../wirings/virtual-user/virtual-user-intents.js';
+export type { VirtualUserRunOutcome, VirtualUserRunRecord, VirtualUserRunStart, VirtualUserRunStore, } from '../wirings/virtual-user/virtual-user-run-store.js';
+export { personaVirtualUserTarget } from '../wirings/virtual-user/virtual-user-target.js';
+export { PRODUCTION_DISPOSITION } from '../wirings/virtual-user/virtual-user.types.js';
+export type { IntentSource, VirtualUserFinding, VirtualUserRunResult, } from '../wirings/virtual-user/virtual-user.types.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { FunctionsMeta } from '../types/core.types.js';
+export type { SystemRoleDefinitions, SystemRoleDefinitionsMeta, } from '../wirings/role/role.types.js';
+export type { VirtualUserPreparation } from '../wirings/virtual-user/prepare-virtual-user-run.js';
+export type { AgentReachability } from '../wirings/virtual-user/virtual-user-agents.js';
+export type { SchemaMap } from '../wirings/virtual-user/virtual-user-derive.js';
+export type { VirtualUserTuning } from '../wirings/virtual-user/virtual-user-dispositions.js';
+export type { ApiCatalogueEntry, VirtualUserDisposition, } from '../wirings/virtual-user/virtual-user.types.js';
+export type { WorkflowsMeta } from '../wirings/workflow/workflow.types.js';

package/dist/ecosystem/virtual-user.js

@@ -0,0 +1,8 @@
+export { personaScopes, prepareVirtualUserRun, } from '../wirings/virtual-user/prepare-virtual-user-run.js';
+export { runVirtualUser } from '../wirings/virtual-user/run-virtual-user.js';
+export { catalogueClassification, isReadOnly, reachableCatalogue, unreachableCatalogue, } from '../wirings/virtual-user/virtual-user-catalogue.js';
+export { deriveCatalogue, deriveIntents, } from '../wirings/virtual-user/virtual-user-derive.js';
+export { DISPOSITIONS, dispositionProfile, } from '../wirings/virtual-user/virtual-user-dispositions.js';
+export { intentsForPersona } from '../wirings/virtual-user/virtual-user-intents.js';
+export { personaVirtualUserTarget } from '../wirings/virtual-user/virtual-user-target.js';
+export { PRODUCTION_DISPOSITION } from '../wirings/virtual-user/virtual-user.types.js';

package/dist/ecosystem/workflow.d.ts

@@ -0,0 +1,20 @@
+export { InMemoryWorkflowService } from '../services/in-memory-workflow-service.js';
+export type { WorkflowService } from '../services/workflow-service.js';
+export type { ApprovalStepMeta, ArrayPredicateStepMeta, BranchStepMeta, CancelStepMeta, Condition, FanoutStepMeta, FilterStepMeta, InlineStepMeta, InputSource, OutputBinding, ParallelGroupStepMeta, PikkuWorkflowWire, RpcStepMeta, SetStepMeta, SleepStepMeta, SuspendStepMeta, SwitchCaseMeta, SwitchStepMeta, WorkflowStepMeta, WorkflowStepOptions, WorkflowWireDoRPC, } from '../wirings/workflow/dsl/workflow-dsl.types.js';
+export { template } from '../wirings/workflow/graph/template.js';
+export type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult, } from '../wirings/workflow/graph/wire-workflow-graph.js';
+export { isRef } from '../wirings/workflow/graph/workflow-graph.types.js';
+export { PikkuWorkflowService } from '../wirings/workflow/pikku-workflow-service.js';
+export { buildRunTimeline, reconstructFinalState, reconstructStateAt, } from '../wirings/workflow/run-timeline.js';
+export type { ReconstructedRunState, RunTimeline, } from '../wirings/workflow/run-timeline.js';
+export { assertWorkflowRunOwner } from '../wirings/workflow/workflow-run-ownership.js';
+export type { ContextVariable, CoreWorkflow, StepState, StepStatus, WorkflowContext, WorkflowPlannedStep, WorkflowQueueOptions, WorkflowRun, WorkflowRunMirror, WorkflowRunService, WorkflowRunStatus, WorkflowRunWire, WorkflowStatus, WorkflowVersionStatus, WorkflowsMeta, WorkflowsRuntimeMeta, } from '../wirings/workflow/workflow.types.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { CoreUserSession } from '../types/core.types.js';
+export type { TemplateString } from '../wirings/workflow/graph/template.js';
+export type { RefValue } from '../wirings/workflow/graph/workflow-graph.types.js';
+export type { HistoryEntry } from '../wirings/workflow/run-timeline.js';

package/dist/ecosystem/workflow.js

@@ -0,0 +1,6 @@
+export { InMemoryWorkflowService } from '../services/in-memory-workflow-service.js';
+export { template } from '../wirings/workflow/graph/template.js';
+export { isRef } from '../wirings/workflow/graph/workflow-graph.types.js';
+export { PikkuWorkflowService } from '../wirings/workflow/pikku-workflow-service.js';
+export { buildRunTimeline, reconstructFinalState, reconstructStateAt, } from '../wirings/workflow/run-timeline.js';
+export { assertWorkflowRunOwner } from '../wirings/workflow/workflow-run-ownership.js';

package/dist/errors/index.d.ts

@@ -1,2 +1,10 @@
 export * from './errors.js';
 export { PikkuError, addError } from './error-handler.js';
+/**
+ * Types the exports above mention but do not themselves export. Without
+ * them a consumer's declaration emit has no name for the type it infers,
+ * and fails with TS2883 rather than reaching for the original entry point.
+ */
+export type { ErrorDetails } from './error-handler.js';
+export { isExpectedError } from './error-handler.js';
+export type { SerializedError } from './serialized-error.js';

package/dist/errors/index.js

@@ -1,2 +1,3 @@
 export * from './errors.js';
 export { PikkuError, addError } from './error-handler.js';
+export { isExpectedError } from './error-handler.js';

package/dist/errors/serialized-error.d.ts

@@ -0,0 +1,7 @@
+export interface SerializedError {
+    message: string;
+    stack?: string;
+    code?: string;
+    expected?: boolean;
+    [key: string]: any;
+}

package/dist/errors/serialized-error.js

@@ -0,0 +1 @@
+export {};

package/dist/function/function-meta.types.d.ts

@@ -0,0 +1,139 @@
+import type { MiddlewareMetadata } from '../middleware/middleware.types.js';
+import type { AuditDurability } from '../services/audit-service.js';
+import type { ScenarioStepKind, ScenarioSurface } from '../wirings/workflow/scenario-step.types.js';
+import type { CommonWireMeta } from '../types/core.types.js';
+export interface FunctionServicesMeta {
+    optimized: boolean;
+    services: string[];
+}
+export interface FunctionWiresMeta {
+    optimized: boolean;
+    wires: string[];
+}
+/**
+ * A reference to a permission function, resolved by name. Function-scoped
+ * only: there are no wire- or tag-level permission references.
+ */
+export type PermissionMetadata = {
+    type: 'wire';
+    name: string;
+    inline?: boolean;
+};
+export type FunctionRuntimeMeta = {
+    pikkuFuncId: string;
+    inputSchemaName: string | null;
+    outputSchemaName: string | null;
+    /** Scopes the session must hold to run this function. All are required (AND). */
+    scopes?: string[];
+    expose?: boolean;
+    /**
+     * A sessionless function's own `auth: true`. `sessionless` carries the
+     * baseline — a `pikkuFunc` always requires a session — and this carries the
+     * tightening a `pikkuSessionlessFunc` applies to itself. Both are needed to
+     * know whether a function is gated without running it.
+     */
+    auth?: boolean;
+    /**
+     * The author's declaration that this function's permission check lives in its
+     * own body. Carries no runtime effect — it records a gate codegen cannot see,
+     * so an audit is not left to guess whether a sessionless function is open.
+     * Refused unless `allow.permissionsInBody` is set in `pikku.config.json`.
+     */
+    permissionsInBody?: boolean;
+    remote?: boolean;
+    /**
+     * A step RPC: invoked by name only from a scenario run and refused
+     * everywhere else, so it is never network-callable.
+     */
+    scenarioStep?: boolean;
+    /**
+     * The body of a `pikkuScenario(...)`. Only ever run by `pikku scenario run`,
+     * so it is held back from the app bootstrap and from every deployed unit.
+     */
+    scenario?: boolean;
+    mcp?: boolean;
+    readonly?: boolean;
+    deploy?: 'serverless' | 'server' | 'auto';
+    sessionless?: boolean;
+    /** When true, workflow steps calling this function are dispatched via the queue. No queue service configured is a hard error. */
+    workflowQueued?: boolean;
+    /** Retry count when this function is used as a workflow step. */
+    workflowRetries?: number;
+    /** Timeout when this function is used as a workflow step (e.g. '30s', '5m'). */
+    workflowTimeout?: string;
+    /**
+     * Scenario steps only: which surfaces this step declares a binding for.
+     *
+     * The reporter derives coverage from this — a `then` with no binding for the
+     * surface the run targeted was never actually witnessed there, which is a gap
+     * worth counting rather than excusing.
+     */
+    scenarioStepSurfaces?: ScenarioSurface[];
+    /**
+     * Scenario steps only: this step runs as a persona, so every call site must
+     * pass one and the runner injects it as `wire.actor`.
+     *
+     * Declared by `actor: true`, or implied by a `browser` binding — a window is
+     * opened as somebody. Absent on a step with nobody to be: an assertion over
+     * what an earlier step returned, or one posting credentials precisely because
+     * it must not reuse an actor's session.
+     */
+    scenarioStepRequiresActor?: boolean;
+    /**
+     * Scenario steps only: who acts. Absent means `persona` — the ordinary step,
+     * and the only kind that existed before the other two.
+     *
+     * A `platform` or `addon` step is the app or a third-party system acting, and
+     * it must never reach a virtual user's catalogue. That is not tidiness: a
+     * virtual user that can invoke "Stripe's webhook arrives" can forge its own
+     * payment success, and every finding downstream of that is worthless.
+     */
+    scenarioStepKind?: ScenarioStepKind;
+    /** Addon steps only: the addon whose system acts — `wireAddon`'s `name`. */
+    scenarioStepAddon?: string;
+    /** Scenario steps only: the prose a reporter renders, with `{placeholders}` filled from the step's recorded input. */
+    scenarioStepTemplate?: string;
+    /**
+     * The function's `audit` config, resolved — `audit: true` reads as
+     * `{ durability: 'best-effort' }`. Absent means the function records nothing:
+     * `auditLog.write()` from an unmarked function is dropped with a warning, so
+     * this is the only place a reader can see which functions have a trail at all
+     * without running them.
+     *
+     * Informational. The runner resolves audit from the live function config, not
+     * from here, so meta and runtime cannot disagree about whether audit is on.
+     */
+    audit?: {
+        durability: AuditDurability;
+    };
+    version?: number;
+    approvalRequired?: boolean;
+    approvalDescription?: string;
+    implementationHash?: string;
+    contractHash?: string;
+    inputHash?: string;
+    outputHash?: string;
+};
+export type FunctionMeta = FunctionRuntimeMeta & Partial<{
+    name: string;
+    /** `remote`: a contract with no local body, answered by a connected client. */
+    functionType: 'user' | 'inline' | 'helper' | 'remote';
+    funcWrapper: string;
+    services: FunctionServicesMeta;
+    wires: FunctionWiresMeta;
+    inputs: string[] | null;
+    outputs: string[] | null;
+    middleware: MiddlewareMetadata[];
+    permissions: PermissionMetadata[];
+    isDirectFunction: boolean;
+    sourceFile: string;
+    exportedName: string;
+    /** File containing the handler body when it differs from sourceFile (imported handlers) */
+    bodySourceFile?: string;
+    /** 1-indexed first line of the handler body (verbose meta; coverage mapping) */
+    bodyStart: number;
+    /** 1-indexed last line of the handler body (verbose meta; coverage mapping) */
+    bodyEnd: number;
+} & CommonWireMeta>;
+export type FunctionsRuntimeMeta = Record<string, FunctionRuntimeMeta>;
+export type FunctionsMeta = Record<string, FunctionMeta>;

package/dist/function/function-meta.types.js

@@ -0,0 +1 @@
+export {};

package/dist/function/function-runner.d.ts

@@ -1,9 +1,10 @@
-import type { CoreUserSession, CorePikkuMiddleware, PikkuWiringTypes, PikkuRawWire, MiddlewareMetadata, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
+import type { CoreUserSession, PikkuWiringTypes, PikkuRawWire, CoreSingletonServices, CreateWireServices } from '../types/core.types.js';
+import type { CorePikkuMiddleware, MiddlewareMetadata } from '../middleware/middleware.types.js';
 import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js';
 import type { CorePikkuFunctionConfig } from './functions.types.js';
 import type { SessionService } from '../services/user-session-service.js';
 import { PikkuCredentialWireService } from '../services/credential-wire-service.js';
-import type { AddonInstance } from '../wirings/rpc/addon-runner.js';
+import type { AddonInstance } from '../wirings/addon/addon-runner.js';
 export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>, packageName?: string | null) => void;
 export declare const getFunctionNames: (packageName?: string | null) => string[];
 export declare const getAllFunctionNames: () => string[];

package/dist/function/function-runner.js

@@ -13,8 +13,8 @@ import { PikkuCredentialWireService, createWireServicesCredentialWireProps, } fr
 import { defaultPikkuUserIdResolver } from '../services/pikku-user-id.js';
 import { createInvocationAudit, resolveAuditConfig, } from '../services/audit-service.js';
 import { rpcService } from '../wirings/rpc/rpc-runner.js';
-import { getOrCreatePackageSingletonServices } from '../wirings/rpc/addon-runner.js';
-import { resolveAddonAuth, resolveAddonScopes, resolveAddonTagMiddleware, } from '../wirings/rpc/wire-addon.js';
+import { getOrCreatePackageSingletonServices } from '../wirings/addon/addon-runner.js';
+import { resolveAddonAuth, resolveAddonFunctionTarget, resolveAddonScopes, resolveAddonTagMiddleware, } from '../wirings/addon/wire-addon.js';
 import { closeWireServices } from '../utils.js';
 async function resolveSession(wire, singletonServices, sessionService) {
     const pikkuUserId = defaultPikkuUserIdResolver(wire);
@@ -77,6 +77,26 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             }
         }
     }
+    /**
+     * The package the *function* belongs to, which is the wire's own until a
+     * `ref()` resolves the target into an addon. The wiring stays the consuming
+     * app's — that is what keeps the app's middleware running rather than the
+     * addon's — but everything the function is declared with lives in the addon's
+     * package state, so its schemas, services and permissions are read from here.
+     */
+    let funcPackageName = packageName;
+    if (!funcMeta) {
+        const addonTarget = resolveAddonFunctionTarget(funcName, packageName);
+        if (addonTarget) {
+            funcConfig =
+                funcConfig ||
+                    pikkuState(addonTarget.packageName, 'function', 'functions').get(addonTarget.localName);
+            funcMeta = pikkuState(addonTarget.packageName, 'function', 'meta')[addonTarget.localName];
+            if (funcMeta) {
+                funcPackageName = addonTarget.packageName;
+            }
+        }
+    }
     if (!funcConfig) {
         throw new Error(`Function not found: ${funcName}`);
     }
@@ -84,12 +104,12 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         throw new Error(`Function meta not found: ${funcName}`);
     }
     const resolvedFunctionId = funcMeta.pikkuFuncId ?? funcName;
-    const resolvedSingletonServices = packageName
-        ? await getOrCreatePackageSingletonServices(packageName, singletonServices, addonInstance)
+    const resolvedSingletonServices = funcPackageName
+        ? await getOrCreatePackageSingletonServices(funcPackageName, singletonServices, addonInstance)
         : singletonServices;
     let resolvedCreateWireServices = createWireServices;
-    if (packageName) {
-        const factories = pikkuState(packageName, 'package', 'factories');
+    if (funcPackageName) {
+        const factories = pikkuState(funcPackageName, 'package', 'factories');
         if (factories?.createWireServices) {
             resolvedCreateWireServices = factories.createWireServices;
         }
@@ -192,11 +212,11 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
         let actualData = await data();
         const inputSchemaName = funcMeta.inputSchemaName;
         if (inputSchemaName) {
-            actualData = applyDefaultsFromSchema(inputSchemaName, actualData, packageName);
+            actualData = applyDefaultsFromSchema(inputSchemaName, actualData, funcPackageName);
             if (coerceDataFromSchema) {
-                coerceTopLevelDataFromSchema(inputSchemaName, actualData, packageName);
+                coerceTopLevelDataFromSchema(inputSchemaName, actualData, funcPackageName);
             }
-            await validateSchema(resolvedSingletonServices.logger, resolvedSingletonServices.schema, inputSchemaName, actualData, packageName);
+            await validateSchema(resolvedSingletonServices.logger, resolvedSingletonServices.schema, inputSchemaName, actualData, funcPackageName);
         }
         await runPermissions({
             funcPermissions: funcConfig.permissions,
@@ -204,7 +224,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             // knowledge: decisions/security/a-permission-gets-a-wire-it-cannot-reply-on.md
             wire: invocationWire,
             data: actualData,
-            packageName,
+            packageName: funcPackageName,
         });
         let wireServices;
         let invocationAuditLog;
@@ -220,7 +240,7 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 invocationAuditLog = createInvocationAudit(resolvedSingletonServices.audit, invocationWire, resolvedSingletonServices.logger);
                 services = { ...services, auditLog: invocationAuditLog };
             }
-            const callerPackageName = packageName;
+            const callerPackageName = funcPackageName;
             Object.defineProperty(invocationWire, 'rpc', {
                 get() {
                     const rpc = rpcService.getContextRPCService(services, invocationWire, { sessionService }, 0, callerPackageName);

package/dist/function/functions.types.d.ts

@@ -1,10 +1,12 @@
-import type { CoreServices, CoreSecretlessSingletonServices, CoreUserSession, CorePikkuMiddleware, PikkuWire, PickRequired, SecretlessServices } from '../types/core.types.js';
+import type { CoreServices, CoreSecretlessSingletonServices, CoreUserSession, PikkuWire, SecretlessServices } from '../types/core.types.js';
+import type { CorePikkuMiddleware } from '../middleware/middleware.types.js';
+import type { PickRequired } from '../utils.js';
 import type { PikkuRPC } from '../wirings/rpc/rpc-types.js';
 import type { StandardSchemaV1 } from '@standard-schema/spec';
 import type { PikkuError } from '../errors/error-handler.js';
 import type { CoreNodeConfig } from '../wirings/node/node.types.js';
 import type { ScenarioSurface } from '../wirings/workflow/scenario-step.types.js';
-import type { Safe } from '../secret-value.js';
+import type { Safe } from '../classification/secret-value.js';
 export type CorePikkuFunction<In, Out, Services extends CoreSecretlessSingletonServices = SecretlessServices<CoreServices>, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, true, Session, PikkuRPC, null, string> = PikkuWire<In, Out, true, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Safe<Out>> : Promise<Safe<Out>> | Promise<void>;
 export type CorePikkuFunctionSessionless<In, Out, Services extends CoreSecretlessSingletonServices = SecretlessServices<CoreServices>, Session extends CoreUserSession = CoreUserSession, Wire extends PikkuWire<In, Out, false, Session, PikkuRPC, null, string> = PikkuWire<In, Out, false, Session>> = (services: Services, data: In, wire: Wire) => Wire['channel'] extends null ? Promise<Safe<Out>> : Promise<Safe<Out>> | Promise<void>;
 export type CorePikkuPermission<In = any, Services extends CoreSecretlessSingletonServices = SecretlessServices<CoreServices>, Wire extends PikkuWire<In, never, false, any, PikkuRPC, never, never> = PikkuWire<In, never, false, any, PikkuRPC, never, never>> = (services: Services, data: In, wire: Wire) => Promise<boolean>;
@@ -83,6 +85,12 @@ export type CorePikkuFunctionConfig<PikkuFunction extends CorePikkuFunction<any,
      * and report how much of the flow each surface actually covers.
      */
     surfaces?: ScenarioSurface[];
+    /**
+     * Scenario steps only: this step is driven by a persona, so the runner injects
+     * `wire.actor` and refuses to dispatch it without one. Set by the definer from
+     * a `browser` binding or an explicit `actor: true`, never written by hand.
+     */
+    requiresActor?: boolean;
     audit?: boolean | {
         durability?: 'best-effort' | 'transactional';
     };